
Compliance monitoring in modern enterprises requires simultaneous adherence to multiple regulatory frameworks (ISO 27001, GDPR, SOC 2, HIPAA, PCI-DSS), yet existing Security Information and Event Management (SIEM) systems lack cross-framework mapping capabilities, explainability, and real-time processing. We present an explainable AI-powered compliance audit system that addresses these limitations by employing a novel architecture that combines knowledge graphs, transformer-based natural language models, and cryptographically signed audit trails. Our system provides real-time monitoring across five compliance frameworks, generates multi-audience explanations (technical, legal, executive), and maintains complete traceability of decisions. Evaluation on 100,000+ events from the LANL Unified Host and Network Dataset demonstrates 89% accuracy in compliance evaluation, 87% accuracy in control mapping, and end-to-end latency of 387ms (p50) on dedicated hardware (Intel Core i7-11700K, 32GB RAM). The system detected 1,247 compliance violations during a 30-day deployment, with 91.5% precision and an 8.5% false-positive rate. Our cross-framework knowledge graph reveals that 34% of applicable controls would be missed without unified mapping. We note that the LANL dataset evaluates the pipeline’s event-processing and rule-evaluation mechanics on authentication telemetry; validation on data-rich environments containing PII, PHI, or payment-card data remains necessary to confirm framework-specific detection accuracy. This work enables proactive compliance management and demonstrates a practical architecture for multi-regulatory compliance monitoring with built-in explainability.

The August 2024 publication of NIST’s first post-quantum cryptography (PQC) standards marks a critical milestone in preparing for quantum-resilient cybersecurity, yet significant gaps persist between technical standardization and practical implementation. This paper examines the policy-practice divide through a comprehensive analysis of federal frameworks (NSM-10, QCCP Act), international coordination efforts, and organizational readiness across sectors. Our research reveals that, although technical standards are mature, implementation faces critical barriers: 89% of federal cyber experts lack dedicated PQC budgets, organizational cryptographic discovery capabilities remain limited, with 43% unable to inventory assets, and estimated migration costs for federal agencies alone reach $7.1 billion through 2035. We analyze coordination mechanisms across the EU, NATO, and Five Eyes alliance, finding the EU’s coordinated 2030 critical infrastructure timeline represents the most comprehensive policy approach, while US federal agencies demonstrate stronger government-industry partnerships. Through synthesis of 30 recent academic sources and economic analysis indicating explosive market growth from $302M to $21B by 2034, we identify five critical implementation gaps: cryptographic asset discovery limitations, workforce expertise shortages, vendor ecosystem maturity delays, interoperability challenges during hybrid deployments, and insufficient automated migration tools. Our analysis provides a novel framework for policy-practice alignment, including phased migration strategies, public-private coordination mechanisms, and economic incentive structures. Key contributions include the identification of optimal timing strategies that balance the costs of premature migration against the urgency of quantum threats, the development of sectoral readiness assessment criteria, and policy recommendations to accelerate practical adoption while maintaining security assurance.